CVE-2026-54902

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description Oj is a JSON parser and Object marshaller for Ruby. A Use-After-Free issue exists when using the Oj::Parser in SAJ mode. The parser fails to protect cached object keys of 35 bytes or more from garbage collection. If a Ruby callback triggers garbage collection within the hash end function, the key string may be reclaimed while the C parser still maintains a pointer to it. Subsequent access to this freed string value can lead to a segmentation fault, potentially allowing control over the freed memory content.

Recommendations Update Oj to version 3.17.2 or later.